From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eduardo Habkost <ehabkost@redhat.com>
Subject: Re: [Qemu-devel] Re: [PATCH] Make page_find() return 0 for
	too-large addresses
Date: Fri, 12 Sep 2008 17:44:05 -0300
Message-ID: <20080912204404.GB10147@blackpad>
References: <20080912185856.GM3982@blackpad> <48CAC809.5000901@codemonkey.ws> <20080912201406.GA10147@blackpad>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: QUOTED-PRINTABLE
Cc: qemu-devel@nongnu.org, kvm@vger.kernel.org, gcosta@redhat.com
To: Anthony Liguori <anthony@codemonkey.ws>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mx2.redhat.com ([66.187.237.31]:36770 "EHLO mx2.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1758249AbYILUqU (ORCPT <rfc822;kvm@vger.kernel.org>);
	Fri, 12 Sep 2008 16:46:20 -0400
Content-Disposition: inline
In-Reply-To: <20080912201406.GA10147@blackpad>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

On Fri, Sep 12, 2008 at 05:14:06PM -0300, Eduardo Habkost wrote:
> On Fri, Sep 12, 2008 at 02:50:33PM -0500, Anthony Liguori wrote:
> > Eduardo Habkost wrote:
> >> On some cases, such as under KVM, tb_invalidate_phys_page_range()
> >> may be called for large addresses, when qemu is configured to more=
 than
> >> 4GB of RAM.
> >>
> >> On these cases, qemu was crashing because it was using an index to=
o
> >> large for l1_map[], that supports only 32-bit addresses when compi=
ling
> >> without CONFIG_USER_ONLY.
> >>  =20
<snip>
>=20
> BTW, I've just noticed page_find_alloc() has this:
>=20
> #if TARGET_LONG_BITS > 32
>     /* Host memory outside guest VM.  For 32-bit targets we have alre=
ady
>        excluded high addresses.  */
>     if (index > ((target_ulong)L2_SIZE * L1_SIZE))
>         return NULL;
> #endif
>=20
> So, we can just use a similar check on page_find().

New patch, reusing the range check from page_find_alloc() on
page_find(). Untested.


Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
---
Index: qemu/exec.c
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--- qemu/exec.c	(revis=E3o 5200)
+++ qemu/exec.c	(c=F3pia de trabalho)
@@ -279,17 +279,24 @@ static void page_init(void)
 #endif
 }
=20
-static inline PageDesc *page_find_alloc(target_ulong index)
+static inline PageDesc **page_l1_map(target_ulong index)
 {
-    PageDesc **lp, *p;
-
 #if TARGET_LONG_BITS > 32
     /* Host memory outside guest VM.  For 32-bit targets we have alrea=
dy
        excluded high addresses.  */
     if (index > ((target_ulong)L2_SIZE * L1_SIZE))
         return NULL;
 #endif
-    lp =3D &l1_map[index >> L2_BITS];
+    return &l1_map[index >> L2_BITS];
+}
+
+static inline PageDesc *page_find_alloc(target_ulong index)
+{
+    PageDesc **lp, *p;
+    lp =3D page_l1_map(index);
+    if (!lp)
+        return NULL;
+
     p =3D *lp;
     if (!p) {
         /* allocate if not found */
@@ -316,9 +323,12 @@ static inline PageDesc *page_find_alloc(
=20
 static inline PageDesc *page_find(target_ulong index)
 {
-    PageDesc *p;
+    PageDesc **lp, *p;
+    lp =3D page_l1_map(index);
+    if (!lp)
+        return NULL;
=20
-    p =3D l1_map[index >> L2_BITS];
+    p =3D *lp;
     if (!p)
         return 0;
     return p + (index & (L2_SIZE - 1));


--=20
Eduardo